274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18

Analysis

Target
emotet_exe_e5_274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18_2022-01-13__221105.exe.dll
Size 408KB
Sample220113-14kwzschcr
SHA256 274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18
MD5 c01ca917225621b106d6023ae54e511e
SHA1 4d37dd629c4e386f57879e921ea0c2368e842d7e
SHA512 9236cd50d46119855a06747a7b9a86fc8a9931d9174963171b2341ca7aa6a25057528ec681899ada5afb2797c83c6599085961e3d08c84dd7220c8e0a6c9e053
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2428	2352	regsvr32.exe	68
PID 2352 wrote to memory of 2428	2352	regsvr32.exe	68
PID 2352 wrote to memory of 2428	2352	regsvr32.exe	68
PID 2428 wrote to memory of 2756	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2756	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2756	2428	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18_2022-01-13__221105.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18_2022-01-13__221105.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_274e7bebc364da7e0996579dcc97d62160128b8dbefb35e4766b21b9fe21bb18_2022-01-13__221105.exe.dll",DllRegisterServer
    3⤵
    PID:2756

memory/2428-120-0x00000000031B5000-0x00000000031B6000-memory.dmp

Download